Microsoft-Windows-L2NACP

Event	Title	Channel	Sample	Rule
13003	The pre-logon connection attempt is complete.	Operational	N	N
13004	The pre-logon connection attempt is complete.	Operational	N	N
13023	The pre-logon connection attempt is complete.	Operational	N	N
13024	The pre-logon connection attempt is complete.	Operational	N	N
14000	Plap Enabled = Enabled.	Diagnostic	N	N

Event ID 13003: The pre-logon connection attempt is complete.

The pre-logon connection attempt is complete.

Network connection attempt result: %1
Reason: %2
Interface GUID: %3
Profile Name: %4

The pre-logon connection attempt is complete.

Windows authentication result: %1
Interface GUID: %2
Profile Name: %3

The pre-logon connection attempt is complete.

Network connection attempt result: %1
Reason: %2
Interface GUID: %3

The pre-logon connection attempt is complete.

Windows authentication result: %1
Interface GUID: %2

Name	Description
`Result` UInt32
`InterfaceGuid` GUID

Plap Enabled = %1

ETW provider GUID 85fe7609-ff4a-48e9-9d50-12918e43e1da

Defined in l2nacp.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB